(I wrote about one aspect of this in using the free GPGTools encryption software with Apple Mail in 2015.) For someone to spoof your identity, they’d have to hijack a number of different accounts you own with different protections. The more proofs, the more likely another person could trust that you’re in control of the key associated with the profile with your name on Keybase. To counter the problem, Keybase lets you prove your identity by posting “proofs” to various places: as tweets, as a public Facebook message, on a website you control, connected to a Bitcoin address, and so on. The message is encrypted with the session key, but only a recipient with an associated private key can retrieve the session key and then decrypt the message.Ī user’s Keybase profile includes all the proofs associated with their identity.
To encrypt a message to one or more people with PGP, you obtain their public keys, and an algorithm encrypts a strong session key-one that can both encrypt and decrypt-with each public key. The other is private, and you must protect it at all costs. One key is public (hence “public-key cryptography”) and can be distributed freely. Knowing one doesn’t help you in any way determine the other. It’s effectively how SSL/TLS works for Web and email encrypted sessions.Ī PGP key comprises a public/private key pair, in which fiendishly complicated math allows the creation of two intertwined keys. PGP combines the power of public-key cryptography with simpler symmetrical encryption for speed. Keybase centers around a PGP-style key, a format that dates back over 20 years. Desktop software introduced a year ago helps a lot. The secret sauce is binding it together into a graphically pleasing and user-comprehensible format, even for those people who have zero interest in or knowledge of the underlying details. The firm’s code is open source, allowing validation, and they rely on open-source software for some of the fundamental parts of what they do. I’ve written about Keybase before, because I admire the combination of approaches they’re taking to provide a simplified strong identity.
0 kommentar(er)
